| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The public views were never part of the admin extraction and were
broken in both directions: German visitors got "Featured", "Calendar"
and "Tags", English visitors got "Suchergebnisse für Suchbegriff:".
Also picks up the unlock-confirm message in link_helper, a straggler
from the revisions/menu_items batch, and drops two raw() calls in the
application layout in favour of link_to blocks.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.
|
|
|
|
|
|
Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Dropped files land in the existing file input and submit through the
unchanged form. An empty name field is prefilled from the basename.
|
